CVE-2026-15746: A Memory Tool That Hands Your Elasticsearch Key to an Attacker

CVE-2026-15746 turns a memory tool into a credential-exfiltration path. In AWS Strands Agents Tools below version 0.7.0, the elasticsearch_memory tool exposed its connection parameters — es_url, cloud_id, api_key — as fields the language model could set through the tool schema. The exploit needs zero valid credentials, zero user interaction beyond a crafted instruction, and zero code execution: a single controlled parameter routes the operator's API key to an attacker's host.

The mechanism

AWS disclosed the flaw on July 15, 2026. The elasticsearch_memory tool in strands-agents-tools accepted es_url, cloud_id and api_key as LLM-controllable schema fields. When a call omitted the api_key, the tool fell back to the operator's environment variable — ELASTICSEARCH_API_KEY — and placed it in the Authorization header of a request sent to whatever host es_url named. A model instructed to point es_url at an attacker-controlled endpoint therefore hands that endpoint a live production credential. AWS lists the fix in strands-agents-tools 0.7.0. The bulletin publishes the vector and the remediation and omits a CVSS score, so severity here rests on the mechanism rather than a headline number.

The root condition

The root condition is familiar for retrieval and tool-using agents: the tool schema treated connection parameters as model-supplied data. A field that names a network destination, exposed to the model, is an SSRF primitive by construction. We documented the same class of defect in an MCP web-research server last week. We explored this in detail here. One controllable destination field is sufficient to convert a memory lookup into outbound credential disclosure.

Three questions for enterprise AI teams

1. Which tools in your agent runtime accept URLs, hostnames, or connection strings as model-supplied arguments? Each is an SSRF candidate.

2. Where do your tools read secrets from environment variables as a fallback? That fallback places a production credential one crafted parameter away from exfiltration.

3. Does your egress policy restrict agent tool calls to an allowlist of trusted endpoints? An allowlist neutralizes the destination-control primitive at the network layer.

CTO and Head of Engineering decisions for the next planning cycle

Upgrade strands-agents-tools to 0.7.0 across every deployment, and patch forked or vendored copies — AWS flags derivative code explicitly. Rotate ELASTICSEARCH_API_KEY now, per the bulletin's guidance, on the assumption of exposure. As a standing control, move destination allowlisting into the agent runtime, so a schema-level mistake in any future tool stays contained at the egress boundary. The pattern recurs across tool-using agents: treat every model-supplied argument as untrusted input, with the same rigor a web application applies to a request parameter.